feat: add same-pubkey batch Schnorr verification (5-6x throughput)

Add verifySchnorrBatch(pub, signatures, messages) that verifies n signatures from the same public key using scalar and point summation instead of n individual mulDoubleG calls. The batch equation exploits linearity of Schnorr signatures: (Σ sᵢ)·G = (Σ Rᵢ) + (Σ eᵢ)·P This combines n verifications into: - n scalar additions for S = Σsᵢ and E = Σeᵢ (trivial) - n liftX + (n-1) addMixed for R_sum = ΣRᵢ (cheap point additions) - ONE mulDoubleG(S, P, -E) (the expensive EC operation, done once) - Check result - R_sum = O (no toAffine needed) JVM benchmark results (same pubkey, 1000 iterations, 500 warmup): batch( 4): 4.1x faster than individual (40,121 events/s) batch( 8): 5.3x faster (49,637 events/s) batch(16): 5.5x faster (49,815 events/s) batch(32): 5.9x faster (51,272 events/s) This fits the Nostr pattern perfectly: when loading a profile or connecting to a relay, many events from the same followed author arrive together and can be batch-verified. If the batch fails (returns false), the caller falls back to individual verification to identify which signature(s) are invalid. Security: by linearity, individual errors cannot cancel without solving the discrete log. For extra hardening, duplicate events from multiple relays can be verified individually as cross-checks. https://claude.ai/code/session_017UbWduFi1sLUsgVUMUH2nx
2026-04-08 02:56:45 +00:00
parent cf7e2d4b0d
commit df9c8a9f4b
3 changed files with 235 additions and 0 deletions
@@ -336,4 +336,67 @@ class Secp256k1Test {
                .sha256(tagHash + tagHash + msg)
        assertEquals(expected.toHexKey(), result.toHexKey())
    }
+
+    // ============================================================
+    // Same-pubkey batch verification
+    // ============================================================
+
+    @Test
+    fun batchSamePubkeyAllValid() {
+        val seckey = "67E56582298859DDAE725F972992A07C6C4FB9F62A8FFF58CE3CA926A1063530".hexToByteArray()
+        val pub = Secp256k1.pubKeyCompress(Secp256k1.pubkeyCreate(seckey)).copyOfRange(1, 33)
+        val sigs = mutableListOf<ByteArray>()
+        val msgs = mutableListOf<ByteArray>()
+        for (i in 0 until 10) {
+            val msg = ByteArray(32) { (i * 7 + it).toByte() }
+            val sig = Secp256k1.signSchnorr(msg, seckey, null)
+            assertTrue(Secp256k1.verifySchnorr(sig, msg, pub), "Individual verify failed for event $i")
+            sigs.add(sig)
+            msgs.add(msg)
+        }
+        assertTrue(Secp256k1.verifySchnorrBatch(pub, sigs, msgs))
+    }
+
+    @Test
+    fun batchSamePubkeyWithInvalid() {
+        val seckey = "67E56582298859DDAE725F972992A07C6C4FB9F62A8FFF58CE3CA926A1063530".hexToByteArray()
+        val pub = Secp256k1.pubKeyCompress(Secp256k1.pubkeyCreate(seckey)).copyOfRange(1, 33)
+        val msg1 = ByteArray(32) { 0x01 }
+        val msg2 = ByteArray(32) { 0x02 }
+        val sig1 = Secp256k1.signSchnorr(msg1, seckey, null)
+        val sig2 = Secp256k1.signSchnorr(msg2, seckey, null)
+        // Corrupt sig2
+        val badSig2 = sig2.copyOf()
+        badSig2[63] = (badSig2[63].toInt() xor 0x01).toByte()
+        assertFalse(Secp256k1.verifySchnorrBatch(pub, listOf(sig1, badSig2), listOf(msg1, msg2)))
+    }
+
+    @Test
+    fun batchSamePubkeyEmpty() {
+        val pub = "67E56582298859DDAE725F972992A07C6C4FB9F62A8FFF58CE3CA926A1063530".hexToByteArray()
+        assertTrue(Secp256k1.verifySchnorrBatch(pub, emptyList(), emptyList()))
+    }
+
+    @Test
+    fun batchSamePubkeySingleFallback() {
+        val seckey = "67E56582298859DDAE725F972992A07C6C4FB9F62A8FFF58CE3CA926A1063530".hexToByteArray()
+        val pub = Secp256k1.pubKeyCompress(Secp256k1.pubkeyCreate(seckey)).copyOfRange(1, 33)
+        val msg = ByteArray(32) { 0x42 }
+        val sig = Secp256k1.signSchnorr(msg, seckey, null)
+        assertTrue(Secp256k1.verifySchnorrBatch(pub, listOf(sig), listOf(msg)))
+    }
+
+    @Test
+    fun batchSamePubkeyLargeBatch() {
+        val seckey = "3982F19BEF1615BCCFBB05E321C10E1D4CBA3DF0E841C2E41EEB6016347653C3".hexToByteArray()
+        val pub = Secp256k1.pubKeyCompress(Secp256k1.pubkeyCreate(seckey)).copyOfRange(1, 33)
+        val sigs = mutableListOf<ByteArray>()
+        val msgs = mutableListOf<ByteArray>()
+        for (i in 0 until 32) {
+            val msg = ByteArray(64) { (i * 13 + it).toByte() }
+            sigs.add(Secp256k1.signSchnorr(msg, seckey, null))
+            msgs.add(msg)
+        }
+        assertTrue(Secp256k1.verifySchnorrBatch(pub, sigs, msgs))
+    }
 }